Re: Running Java across a privilege boundry

[Tim Brown <tmb () 65535 com>]

On Wednesday 26 November 2014 03:54:48 Solar Designer wrote:
> On Sun, Nov 23, 2014 at 05:59:41PM +0300, Solar Designer wrote:
> > So far no distro has expressed any interest in having this embargoed.
> >
> > Distros list members: please speak up (here or on the distros list, with
> > Tim CC'ed) if you'd like this embargoed.
> >
> > Tim: if until Tuesday no distro says they want this embargoed, please go
> > ahead and make the issue fully public.  (On a related note, I hate it
> > when an issue is sort of "semi-public".  It's the worst possible case.
> > When this happens, it's a reason to opt for a shorter embargo period, or
> > for none at all indeed.)  If an embargo is requested, please make sure
> > there's an exact date and time for the planned public disclosure.
>
> So far no distro has expressed any interest in having this embargoed,
> and no specific coordinated disclosure date has been proposed by anyone.
> Tim, please make the issue public now by posting it in here.  Thanks!

Apologies, I was locked in a server room for the last 2-3 weeks without access 
to my Internet.

The issue for anyone that was interested was as follows:

> $ objdump -x /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java | grep RPATH
>
>   RPATH                $ORIGIN/../lib/amd64/jli:bootstrap/jre/lib/amd64/jli:
> $ORIGIN/../lib/amd64:bootstrap/lib/amd64:
> $ORIGIN/../jre/lib/amd64:bootstrap/jre/lib/amd64
> $ mkdir -p bootstrap/jre/lib/amd64/jli
> $ touch bootstrap/jre/lib/amd64/jli/libc.so.6
> $ sudo java
> java: error while loading shared libraries:
> bootstrap/jre/lib/amd64/jli/libc.so.6: file too short
>
> I haven't checked if this is an upstream problem or whether just Debian is
> affected.
>
> Whilst strictly speaking, there is no security boundary offered by Java
> itself, in the case of unsafe RPATH headers on a ELF binary, sudo can do
> nothing to sanitise the environment. Nor indeed could an arbitrary setuid
> which ends up calling Java with additional privileges. (Unlike say PATH
> etc which sudo can quite happily sanitise.)
>
> As such, only fixing the java binary itself will prevent library injection
> into any Java application that is run interactively (or maybe otherwise)
> in such a manner.

Cheers,
Tim
-- 
Tim Brown
<mailto:tmb () 65535 com>

Attachment: signature.asc
Description: This is a digitally signed message part.